ArcadeDB versions up to 26.7.3 have an insecure direct object reference in the Raft cluster‑information endpoints. The endpoints authenticate requests but do not enforce authorization, which means any authenticated user, even one with access to only a single database or no databases, can enumerate the full database registry and retrieve sensitive metadata such as database names, last transaction IDs, bootstrap fingerprints, and cluster topology. The vulnerability can lead to cross‑database information disclosure, compromising confidentiality of cluster configuration data. It is classified as CWE‑200.

The affected products are ArcadeData ArcadeDB versions 26.7.3 and earlier. The flaw is present only when the HA cluster configuration is enabled (arcadedb.ha.enabled set to true) and the ha‑raft module is loaded. Users deploying ArcadeDB in a high‑availability cluster environment should verify their version and configuration.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication, but any authenticated user can trigger the information disclosure, making the risk higher in environments where many users have valid credentials. An attacker could obtain cluster topology and database metadata, potentially facilitating further attacks such as privilege escalation or targeted exploits against specific databases. Because no elevation of privilege or code execution is involved, the primary risk is confidentiality exposure.